SOC 2

The Service and Organization Controls (SOC) 2 is a report based on the Auditing Standards Board of the American Institute of Certified Public Accountants (AICPA) SSAE 18, which evaluates the service organization’s controls relevant to the Trust Services Criteria of security, availability, processing integrity, confidentiality, or privacy.

Looking for Google Cloud and Google Workspace SOC 2 reports? Customers can request the reports at their convenience via Compliance Reports Manager.

Google Cloud and SOC 2 compliance

Accessing Google Cloud’s SOC 2 reports

Google Cloud regularly undergoes third-party audits for our products, systems, and infrastructure related to this standard. The SOC 2 reports are generated by an objective third party attesting to a set of assertions made by Google Cloud about its controls that are in place to protect customer data. The audit firm’s evaluation includes comprehensive testing of the design and operating effectiveness of the controls within the audit period. 

Customers may use the SOC 2 report to assess the risks arising from interactions with the assessed Google Cloud and Google Workspace systems throughout the period.

Google Cloud’s SOC 2 timelines

Core Google Cloud and Google Workspace SOC 2 reports

The core Google Cloud and Google Workspace SOC 2 Type II reports are issued semi-annually and can be downloaded via the Compliance Reports Manager. The coverage periods and issuance dates for these reports are:

  • First half of the year 
  • Coverage period: May 1 - April 30
  • Estimated issuance: mid-June
  • Second half of the year 
  • Coverage period: November 1 - October 31
  • Estimated issuance: mid-December

Additional Google Cloud SOC 2 reports

We issue separate SOC 2 Type II reports for a small subset of Google Cloud products, including AppSheet, Backup and Disaster Recovery, Google Cloud VMware Engine, Bare Metal Solution, Apigee Edge, Actifio Heritage, StratoZone, Google Security Operations SOAR, Mandiant, and Looker (Google Cloud core). These reports are issued annually and customers can obtain these reports by contacting sales or support.

Bridge letters

Bridge letters are attestations made by the management of the service provider, in this case, Google Cloud, and are intended to “bridge” the gap from the end date of the SOC report to the customer’s period end date. Bridge letters summarize material changes or issues identified within the internal control environment beyond the period end date of the most recent SOC report. Bridge letters are available for SOC 1 and SOC 2 reports.

Google Cloud creates monthly bridge letters with each letter designed to cover the period since the most recent SOC report. For example, Google Cloud issues a bridge letter in early January to cover the look-back period of November 1 to December 31, which extends the coverage period of the previously issued SOC report with a period end date of October 31.

SOC bridge letters for the core Google Cloud and Google Workspace SOC 2 reports are made available on Compliance Reports Manager for the periods ending March 31, June 30, September 30, and December 31 and can be downloaded directly. If a bridge letter covering a different period end date or product scope is required, please contact sales or support.

FAQs

Google Cloud’s independent auditors are Ernst & Young LLP and Coalfire.

A SOC 2 Type I report covers the design of the service organization's controls at a specific point in time. A SOC 2 Type II report covers the design and operating effectiveness of the service organization's controls over a period of time. For example, a SOC 2 Type I may assess the service organization’s controls as of today, but a SOC 2 Type II assesses the service organization’s controls within the past six months. Google Cloud only issues SOC 2 Type II reports.

Services in scope

Below are Google Cloud services that are in scope for SOC 2.

Where we are simplifying the name of our service, we have also included its former name in parentheses.

Access Approval

Access Context Manager

Access Transparency

Advanced API Security

Agent Assist

AI Platform Deep Learning Container

AI Platform Neural Architecture Search (NAS)

AI Platform Training and Prediction

AlloyDB

Anti-Money Laundering (AML) AI

API Gateway

Apigee

App Engine

Application Integration

Artifact Analysis

Artifact Registry

Assured Workloads

AutoML Natural Language

AutoML Tables

AutoML Translation

AutoML Video

AutoML Vision

Backup and DR Service

Backup for GKE

Bare Metal Solution

Batch

BeyondCorp Enterprise

BigQuery

BigQuery Omni

BigQuery Data Transfer Service

Bigtable

Binary Authorization

Certificate Authority Service

Certificate Manager

Cloud Asset Inventory

Cloud Billing

Cloud Build

Cloud CDN

Cloud Composer

Cloud Data Fusion

Cloud Deploy

Cloud Deployment Manager

Cloud DNS

Cloud Endpoints

Cloud External Key Manager (Cloud EKM)

Cloud Filestore

Cloud Firewall

Cloud Functions

Cloud Functions for Firebase

Cloud Hardware Security Module (HSM)

Cloud Healthcare API

Cloud Intrusion Detection System (IDS)

Cloud Interconnect

Cloud Key Management Service (KMS)

Cloud Life Sciences (formerly Google Genomics)

Cloud Load Balancing

Cloud Logging

Cloud Monitoring

Cloud NAT (Network Address Translation)

Cloud Natural Language API

Cloud Profiler

Cloud Router

Cloud Run (fully managed)

Cloud Scheduler

Cloud SDK

Cloud Service Mesh

Cloud Shell

Cloud Source Repositories

Cloud Speaker ID

Cloud SQL

Cloud Storage

Cloud Storage for Firebase

Cloud Tasks

Cloud Trace

Cloud Translation

Cloud Virtual Private Network (VPN)

Cloud Vision

Cloud Workstations

Compute Engine

Config Management

Connect

Contact Center AI (CCAI)

Contact Center AI Insights

Contact Center AI Platform

Container Registry

Data Catalog

Database Migration Service

Dataflow

Dataform

Datalab

Dataplex

Dataproc

Dataproc Metastore

Datastore

Datastream

Dialogflow

Discovery Solutions

Document AI

Earth Engine

Eventarc

Firebase Authentication

Firebase Test Lab

Firestore

Game Servers

Gemini for Google Cloud

Generative AI on Vertex AI (formerly Generative AI Support on Vertex AI)

GKE Enterprise Config Management

GKE Hub

GKE Identity Service

Google Cloud App

Google Cloud Armor

Google Cloud console

Google Cloud Identity-Aware Proxy

Google Cloud Marketplace

Google Cloud VMware Engine (GCVE)

Google Kubernetes Engine

Google Security Operations

Healthcare Data Engine (HDE)

Identity & Access Management (IAM)

Identity Platform

Infrastructure Manager

Key Access Justifications (KAJ)

Knative serving

Looker (Google Cloud Core)

Looker Studio

Managed Service for Microsoft Active Directory (AD)

Media CDN

Memorystore

Migrate to Virtual Machines (formerly Migrate for Compute Engine)

Migration Center

Network Connectivity Center

Network Intelligence Center

Network Service Tiers

Notebooks (formerly AI Platform Notebooks)

Persistent Disk

Pub/Sub

reCAPCTHA Enterprise

Recommendations AI

Recommender

Resource Manager API

Retail Search

Risk Manager

Secret Manager

Secure Source Manager

Security Command Center

Sensitive Data Protection (including Cloud Data Loss Prevention)

Service Directory

Service Infrastructure

Service Mesh

Spanner

Spectrum Access System

Speech-to-Text

Storage Transfer Service

Tables

Talent Solution

Text-to-Speech

Threat Intelligence for Google Security Operations

Traffic Director

Transcoder API

Vertex AI Codey

Vertex AI Colab Enterprise

Vertex AI Conversation (formerly Generative AI App Builder)

Vertex AI Data Labeling

Vertex AI Platform (formerly Vertex AI)

Vertex AI Search (formerly Gen App Builder – Enterprise Search)

Vertex AI Workbench Instances

Virtual Private Cloud (VPC)

Video Intelligence API

VirusTotal

VPC Service Controls

Web Risk API

Workflows

Workload Manager

Relevant products and services

Access Transparency

When Google Cloud administrators access your content, Access Transparency gives you near real-time logs of their actions.

Learn more

Cloud Key Management Service

Manage cryptographic keys for your cloud services the same way you do on-premises, to protect secrets and other sensitive data that you store in Google Cloud.

Learn more

Google Cloud Armor

Delivers defense at scale against infrastructure and application DDoS attacks using Google’s global infrastructure and security systems.

Learn more

Security Command Center

Prevent and detect threats in virtual machines, networks, applications, and storage from one location, and act on them before they cause damage or loss.

Learn more

Sensitive Data Protection (including Cloud Data Loss Prevention)

Provides fast, scalable classification and redaction for sensitive data elements like names, credit card numbers, Google Cloud credentials, and more. 

Learn more

VPC Service Controls

Keeps sensitive data private by defining a security perimeter around Google Cloud resources like Cloud Storage buckets, Bigtable instances, and BigQuery datasets.

Learn more

Take the next step

Start building on Google Cloud with $300 in free credits and 20+ always free products.

Google Cloud
  • ‪English‬
  • ‪Deutsch‬
  • ‪Español‬
  • ‪Español (Latinoamérica)‬
  • ‪Français‬
  • ‪Indonesia‬
  • ‪Italiano‬
  • ‪Português (Brasil)‬
  • ‪简体中文‬
  • ‪繁體中文‬
  • ‪日本語‬
  • ‪한국어‬
콘솔
Google Cloud